UMEP
VFEP
Static task
static1
Behavioral task
behavioral1
Sample
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8.dll
Resource
win10v2004-en-20220113
Target
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
Size
2.1MB
MD5
ce4a1572a1c6c4aa5e5731d44f3a1db0
SHA1
8cf9e66744745fad5928ed8406db339e01a75de6
SHA256
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
SHA512
1b98807d18ff14b537f34d0697eecb3e88b4f18f2a5f65169cae5c4d7aa1f8b8028f4c5935eec757e702863b7189d27c13b4886d2b41a5288821e316bfe68b88
SSDEEP
49152:VTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJHlJo:1RCBNTBwAHlJo
File contains strings specific to ComRAT v4 samples first seen in 2017.
resource | yara_rule |
---|---|
sample | ComRAT |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CreateFileW
ExpandEnvironmentStringsW
IsBadStringPtrA
MapViewOfFile
UnmapViewOfFile
SetEvent
FlushViewOfFile
GetCurrentProcess
OpenProcess
GetLocalTime
SetHandleInformation
ReadFile
MultiByteToWideChar
SetFileTime
GetOEMCP
GetProcAddress
LoadLibraryA
OpenEventW
GetFileSize
SetFilePointer
WriteFile
GetModuleHandleW
LoadLibraryW
GetVersionExW
VirtualProtectEx
GetExitCodeThread
lstrcmpiW
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
GetModuleHandleA
WriteProcessMemory
CreateThread
WideCharToMultiByte
CreateDirectoryW
DeleteFileW
CloseHandle
CreateEventW
TerminateProcess
Sleep
CreateProcessW
GetLastError
GetTickCount
WaitForSingleObject
GetNativeSystemInfo
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreatePipe
InitializeCriticalSection
SetStdHandle
OutputDebugStringW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetSystemTimeAsFileTime
GetFileAttributesExW
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
HeapReAlloc
GetCPInfo
GetCommandLineA
GetCurrentThreadId
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableW
SetEnvironmentVariableA
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
FreeLibrary
LoadLibraryExW
HeapSize
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetEndOfFile
CryptDestroyHash
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptDecrypt
CryptDestroyKey
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
CryptHashData
GetModuleBaseNameA
EnumProcessModulesEx
EnumProcessModules
UMEP
VFEP
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ